syzbot

==================================================================
BUG: KASAN: slab-use-after-free in timer_is_static_object+0x3c/0x90 kernel/time/timer.c:691
Read of size 8 at addr ffff0000ddab3c98 by task syz.2.2026/14248

CPU: 0 UID: 0 PID: 14248 Comm: syz.2.2026 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xa8/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0xb0/0x110 mm/kasan/report.c:595
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 timer_is_static_object+0x3c/0x90 kernel/time/timer.c:691
 lookup_object_or_alloc lib/debugobjects.c:679 [inline]
 debug_object_activate+0x12c/0x460 lib/debugobjects.c:820
 debug_timer_activate kernel/time/timer.c:793 [inline]
 __mod_timer+0x8c4/0xd00 kernel/time/timer.c:1124
 add_timer+0x6c/0x8c kernel/time/timer.c:1249
 rose_start_t0timer net/rose/rose_link.c:52 [inline]
 rose_t0timer_expiry+0x200/0x348 net/rose/rose_link.c:87
 call_timer_fn+0x1b4/0x818 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x51c/0x76c kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0xcc/0x194 kernel/time/timer.c:2403
 handle_softirqs+0x328/0xc88 kernel/softirq.c:622
 __do_softirq+0x14/0x20 kernel/softirq.c:656
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
 invoke_softirq kernel/softirq.c:503 [inline]
 __irq_exit_rcu+0x1b0/0x478 kernel/softirq.c:723
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:739
 __el1_irq arch/arm64/kernel/entry-common.c:520 [inline]
 el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:532
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:537
 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:592
 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] (P)
 _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:194 (P)
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 __wake_up_common_lock kernel/sched/wait.c:127 [inline]
 __wake_up_sync_key+0x13c/0x18c kernel/sched/wait.c:192
 __unix_dgram_recvmsg+0x37c/0xb7c net/unix/af_unix.c:2626
 unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2700
 sock_recvmsg_nosec+0x90/0xec net/socket.c:1078
 ____sys_recvmsg+0x5e0/0x744 net/socket.c:2848
 ___sys_recvmsg+0x188/0x45c net/socket.c:2892
 do_recvmmsg+0x294/0x7cc net/socket.c:2987
 __sys_recvmmsg net/socket.c:3061 [inline]
 __do_sys_recvmmsg net/socket.c:3084 [inline]
 __se_sys_recvmmsg net/socket.c:3077 [inline]
 __arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:3077
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:746
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:765
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

Allocated by task 9654:
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:77
 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:573
 poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:417
 kasan_kmalloc include/linux/kasan.h:262 [inline]
 __kmalloc_cache_noprof+0x3a4/0x65c mm/slub.c:5748
 kmalloc_noprof include/linux/slab.h:957 [inline]
 rose_add_node+0x1f4/0xcc0 net/rose/rose_route.c:85
 rose_rt_ioctl+0xb08/0xf90 net/rose/rose_route.c:748
 rose_ioctl+0x378/0xab8 net/rose/af_rose.c:1381
 sock_do_ioctl+0xf4/0x2b4 net/socket.c:1254
 sock_ioctl+0x57c/0x84c net/socket.c:1375
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __arm64_sys_ioctl+0x14c/0x1c4 fs/ioctl.c:583
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:746
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:765
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

Freed by task 6755:
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:77
 __kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:587
 kasan_save_free_info mm/kasan/kasan.h:406 [inline]
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2523 [inline]
 slab_free mm/slub.c:6611 [inline]
 kfree+0x184/0x600 mm/slub.c:6818
 rose_neigh_put include/net/rose.h:166 [inline]
 rose_timer_expiry+0x43c/0x5ac net/rose/rose_timer.c:183
 call_timer_fn+0x1b4/0x818 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x51c/0x76c kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0xcc/0x194 kernel/time/timer.c:2403
 handle_softirqs+0x328/0xc88 kernel/softirq.c:622
 __do_softirq+0x14/0x20 kernel/softirq.c:656

The buggy address belongs to the object at ffff0000ddab3c00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 152 bytes inside of
 freed 512-byte region [ffff0000ddab3c00, ffff0000ddab3e00)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11dab0
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000040 ffff0000c0001c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 05ffc00000000040 ffff0000c0001c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 05ffc00000000002 fffffdffc376ac01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000ddab3b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000ddab3c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000ddab3c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff0000ddab3d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000ddab3d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
------------[ cut here ]------------
ODEBUG: activate not available (active state 0) object: 00000000c18d30f7 object type: timer_list hint: __ll_sc_atomic_fetch_sub_release arch/arm64/include/asm/atomic_ll_sc.h:-1 [inline]
ODEBUG: activate not available (active state 0) object: 00000000c18d30f7 object type: timer_list hint: arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline]
ODEBUG: activate not available (active state 0) object: 00000000c18d30f7 object type: timer_list hint: raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:944 [inline]
ODEBUG: activate not available (active state 0) object: 00000000c18d30f7 object type: timer_list hint: atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline]
ODEBUG: activate not available (active state 0) object: 00000000c18d30f7 object type: timer_list hint: __refcount_sub_and_test include/linux/refcount.h:389 [inline]
ODEBUG: activate not available (active state 0) object: 00000000c18d30f7 object type: timer_list hint: __refcount_dec_and_test include/linux/refcount.h:432 [inline]
ODEBUG: activate not available (active state 0) object: 00000000c18d30f7 object type: timer_list hint: refcount_dec_and_test include/linux/refcount.h:450 [inline]
ODEBUG: activate not available (active state 0) object: 00000000c18d30f7 object type: timer_list hint: ax25_cb_put include/net/ax25.h:281 [inline]
ODEBUG: activate not available (active state 0) object: 00000000c18d30f7 object type: timer_list hint: rose_link_up net/rose/rose_link.c:131 [inline]
ODEBUG: activate not available (active state 0) object: 00000000c18d30f7 object type: timer_list hint: rose_t0timer_expiry+0x0/0x348 net/rose/rose_link.c:271
WARNING: CPU: 0 PID: 14248 at lib/debugobjects.c:615 debug_print_object lib/debugobjects.c:612 [inline]
WARNING: CPU: 0 PID: 14248 at lib/debugobjects.c:615 debug_object_activate+0x344/0x460 lib/debugobjects.c:842
Modules linked in:
CPU: 0 UID: 0 PID: 14248 Comm: syz.2.2026 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025
pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : debug_print_object lib/debugobjects.c:612 [inline]
pc : debug_object_activate+0x344/0x460 lib/debugobjects.c:842
lr : debug_print_object lib/debugobjects.c:612 [inline]
lr : debug_object_activate+0x344/0x460 lib/debugobjects.c:842
sp : ffff800097927a70
x29: ffff800097927a70 x28: ffff800097696000 x27: dfff800000000000
x26: ffff80008aed7f20 x25: 0000000000000000 x24: ffff0000ddab3c90
x23: 0000000000000005 x22: ffff80008b3fbf00 x21: ffff800089f710e8
x20: ffff80008aed7f20 x19: ffff0000ddab3c90 x18: 00000000c24a41d0
x17: 3d3d3d3d3d3d3d3d x16: ffff800082de9540 x15: 0000000000000001
x14: 1fffe000337db6fa x13: 0000000000000000 x12: 0000000000000000
x11: ffff6000337db6fb x10: 0000000000ff0100 x9 : 25a792740061fa00
x8 : 25a792740061fa00 x7 : 0000000000000001 x6 : ffff8000805638d4
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000807d4f2c
x2 : 0000000000000001 x1 : 0000000100000102 x0 : 0000000000000000
Call trace:
 debug_print_object lib/debugobjects.c:612 [inline] (P)
 debug_object_activate+0x344/0x460 lib/debugobjects.c:842 (P)
 debug_timer_activate kernel/time/timer.c:793 [inline]
 __mod_timer+0x8c4/0xd00 kernel/time/timer.c:1124
 add_timer+0x6c/0x8c kernel/time/timer.c:1249
 rose_start_t0timer net/rose/rose_link.c:52 [inline]
 rose_t0timer_expiry+0x200/0x348 net/rose/rose_link.c:87
 call_timer_fn+0x1b4/0x818 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x51c/0x76c kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0xcc/0x194 kernel/time/timer.c:2403
 handle_softirqs+0x328/0xc88 kernel/softirq.c:622
 __do_softirq+0x14/0x20 kernel/softirq.c:656
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:68
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:891
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:73
 invoke_softirq kernel/softirq.c:503 [inline]
 __irq_exit_rcu+0x1b0/0x478 kernel/softirq.c:723
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:739
 __el1_irq arch/arm64/kernel/entry-common.c:520 [inline]
 el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:532
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:537
 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:592
 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] (P)
 _raw_spin_unlock_irqrestore+0x44/0x98 kernel/locking/spinlock.c:194 (P)
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 __wake_up_common_lock kernel/sched/wait.c:127 [inline]
 __wake_up_sync_key+0x13c/0x18c kernel/sched/wait.c:192
 __unix_dgram_recvmsg+0x37c/0xb7c net/unix/af_unix.c:2626
 unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2700
 sock_recvmsg_nosec+0x90/0xec net/socket.c:1078
 ____sys_recvmsg+0x5e0/0x744 net/socket.c:2848
 ___sys_recvmsg+0x188/0x45c net/socket.c:2892
 do_recvmmsg+0x294/0x7cc net/socket.c:2987
 __sys_recvmmsg net/socket.c:3061 [inline]
 __do_sys_recvmmsg net/socket.c:3084 [inline]
 __se_sys_recvmmsg net/socket.c:3077 [inline]
 __arm64_sys_recvmmsg+0x17c/0x238 net/socket.c:3077
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x254 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x5c/0x254 arch/arm64/kernel/entry-common.c:746
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:765
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
irq event stamp: 141771
hardirqs last  enabled at (141770): [<ffff80008ae11c1c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (141770): [<ffff80008ae11c1c>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (141771): [<ffff80008ae11a4c>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (141771): [<ffff80008ae11a4c>] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162
softirqs last  enabled at (134708): [<ffff8000803d7488>] softirq_handle_end kernel/softirq.c:468 [inline]
softirqs last  enabled at (134708): [<ffff8000803d7488>] handle_softirqs+0xaf8/0xc88 kernel/softirq.c:650
softirqs last disabled at (141685): [<ffff800080022024>] __do_softirq+0x14/0x20 kernel/softirq.c:656
---[ end trace 0000000000000000 ]---
vkms_vblank_simulate: vblank timer overrun